LegalizeCommission Delegated Regulation (EU) 2025/2003 of 8 September 2025 amending Regulation (EU) 2021/821 of the European Parliament and of the Council as regards the list of dual-use items
This is the act as published. Later amendments are not folded into the text below: each one is a separate act in this repository and an entry in this law's history.
| 5E001 | "Technology" as follows: a. "Technology" according to the General Technology Note for the "development", "production" or "use" (excluding operation) of equipment, functions or features specified in 5A001 or "software" specified in 5D001.a. or 5D001.e.; b. Specific "technology" as follows: 1. "Technology""required" for the "development" or "production" of telecommunications equipment specially designed to be used on board "spacecraft"; 2. "Technology" for the "development" or "use" of "laser" communication techniques with the capability of automatically acquiring and tracking signals and maintaining communications through exoatmosphere or sub-surface (water) media; 3. "Technology" for the "development" of digital cellular radio base station receiving equipment whose reception capabilities that allow multi-band, multi-channel, multi-mode, multi-coding algorithm or multi-protocol operation can be modified by changes in "software"; 4. "Technology" for the "development" of "spread spectrum" techniques, including "frequency hopping" techniques; Note: 5E001.b.4. does not control "technology" for the "development" of any of the following: a. Civil cellular radio-communications systems; or b. Fixed or mobile satellite earth stations for commercial civil telecommunications. c. "Technology" according to the General Technology Note for the "development" or "production" of any of the following: 1. Not used; 2. Equipment employing a "laser" and having any of the following: a. A transmission wavelength exceeding 1 750 nm; or b. Not used; c. Not used; d. Employing wavelength division multiplexing techniques of optical carriers at less than 100 GHz spacing; or e. Employing analogue techniques and having a bandwidth exceeding 2,5 GHz; Note: 5E001.c.2.e. does not control "technology" for commercial TV systems. N.B. For "technology" for the "development" or "production" of non-telecommunications equipment employing a laser, see 6E. 3. Equipment employing 'optical switching' and having a switching time less than 1 ms; Technical Note: For the purposes of 5E001.c.3., 'optical switching' is the routing of or switching of signals in optical form without conversion to electrical signals. 4. Radio equipment having any of the following: a. Quadrature-Amplitude-Modulation (QAM) techniques above level 1 024; b. Operating at input or output frequencies exceeding 31,8 GHz; or Note: 5E001.c.4.b. does not control "technology" for equipment designed or modified for operation in any frequency band which is "allocated by the ITU" for radio-communications services, but not for radio-determination. c. Operating in the 1,5 MHz to 87,5 MHz band and incorporating adaptive techniques providing more than 15 dB suppression of an interfering signal; or 5. Not used; 6. Mobile equipment having all of the following: a. Operating at an optical wavelength greater than or equal to 200 nm and less than or equal to 400 nm; and b. Operating as a "local area network"; d. "Technology" according to the General Technology Note for the "development" or "production" of "Monolithic Microwave Integrated Circuit" ("MMIC") amplifiers specially designed for telecommunications and that are any of the following: Technical Note: For the purposes of 5E001.d., the parameter peak saturated power output may also be referred to on product data sheets as output power, saturated power output, maximum power output, peak power output, or peak envelope power output. 1. Rated for operation at frequencies exceeding 2,7 GHz up to and including 6,8 GHz with a "fractional bandwidth" greater than 15 %, and having any of the following: a. A peak saturated power output greater than 75 W (48,75 dBm) at any frequency exceeding 2,7 GHz up to and including 2,9 GHz; b. A peak saturated power output greater than 55 W (47,4 dBm) at any frequency exceeding 2,9 GHz up to and including 3,2 GHz; c. A peak saturated power output greater than 40 W (46 dBm) at any frequency exceeding 3,2 GHz up to and including 3,7 GHz; or d. A peak saturated power output greater than 20 W (43 dBm) at any frequency exceeding 3,7 GHz up to and including 6,8 GHz; 2. Rated for operation at frequencies exceeding 6,8 GHz up to and including 16 GHz with a "fractional bandwidth" greater than 10 %, and having any of the following: a. A peak saturated power output greater than 10W (40 dBm) at any frequency exceeding 6,8 GHz up to and including 8,5 GHz; or b. A peak saturated power output greater than 5W (37 dBm) at any frequency exceeding 8,5 GHz up to and including 16 GHz; 3. Rated for operation with a peak saturated power output greater than 3 W (34,77 dBm) at any frequency exceeding 16 GHz up to and including 31,8 GHz, and with a "fractional bandwidth" of greater than 10 %; 4. Rated for operation with a peak saturated power output greater than 0,1 nW (-70 dBm) at any frequency exceeding 31,8 GHz up to and including 37 GHz; 5. Rated for operation with a peak saturated power output greater than 1 W (30 dBm) at any frequency exceeding 37 GHz up to and including 43,5 GHz, and with a "fractional bandwidth" of greater than 10 %; 6. Rated for operation with a peak saturated power output greater than 31,62 mW (15 dBm) at any frequency exceeding 43,5 GHz up to and including 75 GHz, and with a "fractional bandwidth" of greater than 10 %; 7. Rated for operation with a peak saturated power output greater than 10 mW (10 dBm) at any frequency exceeding 75 GHz up to and including 90 GHz, and with a "fractional bandwidth" of greater than 5 %; or 8. Rated for operation with a peak saturated power output greater than 0,1 nW (-70 dBm) at any frequency exceeding 90 GHz; e. "Technology" according to the General Technology Note for the "development" or "production" of electronic devices and circuits, specially designed for telecommunications and containing components manufactured from "superconductive" materials, specially designed for operation at temperatures below the "critical temperature" of at least one of the "superconductive" constituents and having any of the following: 1. Current switching for digital circuits using "superconductive" gates with a product of delay time per gate (in seconds) and power dissipation per gate (in watts) of less than 10-14 J; or 2. Frequency selection at all frequencies using resonant circuits with Q-values exceeding 10 000. | |
| --- | --- | --- |
| 5E101 | "Technology" according to the General Technology Note for the "development", "production" or "use" of equipment specified in 5A101. |
Part 2 - "INFORMATION SECURITY"
- Note 1: Not used.
- Note 2: Category 5, Part 2 does not control products when accompanying their user for the user's personal use.
- Note 3: Cryptography Note
5A002, 5D002.a.1., 5D002.b. and 5D002.c.1. do not control items as follows:
- a. Items that meet all of the following:
- 1. Generally available to the public by being sold, without restriction, from stock at retail selling points by means of any of the following:
- a. Over-the-counter transactions;
- b. Mail order transactions;
- c. Electronic transactions; or
- d. Telephone call transactions;
- 2. The cryptographic functionality cannot easily be changed by the user;
- 3. Designed for installation by the user without further substantial support by the supplier; and
- 4. When necessary, details of the goods are accessible and will be provided, upon request, to the competent authorities of the EU Member State in which the exporter is established in order to ascertain compliance with conditions described in paragraphs 1. to 3. above;
- b. Hardware components or 'executable software', of existing items described in paragraph a. of this Note, that have been designed for these existing items, meeting all of the following:
- 1. "Information security" is not the primary function or set of functions of the component or 'executable software';
- 2. The component or 'executable software' does not change any cryptographic functionality of the existing items, or add new cryptographic functionality to the existing items;
- 3. The feature set of the component or 'executable software' is fixed and is not designed or modified to customer specification; and
- 4. When necessary as determined by the competent authorities of the EU Member State in which the exporter is established, details of the component or 'executable software' and details of relevant end-items are accessible and will be provided to the competent authority upon request, in order to ascertain compliance with conditions described above.
Technical Note:
For the purposes of the Cryptography Note, 'executable software' means "software" in executable form, from an existing hardware component excluded from 5A002 by the Cryptography Note.
- Note: 'Executable software' does not include complete binary images of the "software" running on an end-item.
Note to the Cryptography Note:
- 1. To meet paragraph a. of Note 3, all of the following must apply:
- a. The item is of potential interest to a wide range of individuals and businesses; and
- b. The price and information about the main functionality of the item are available before purchase without the need to consult the vendor or supplier. A simple price enquiry is not considered to be a consultation.
- 2. In determining eligibility of paragraph a. of Note 3, competent authorities may take into account relevant factors such as quantity, price, required technical skill, existing sales channels, typical customers, typical use or any exclusionary practices of the supplier.
5A2 Systems, Equipment and Components
| 5A002 | "Information security" systems, equipment and components, as follows: N.B. For the control of "satellite navigation system" receiving equipment containing or employing decryption, see 7A005 and for related decryption "software" and "technology", see 7D005 and 7E001. a. Designed or modified to use 'cryptography for data confidentiality' having a 'described security algorithm', as follows: 1. Items having "information security" as a primary function; 2. Digital communication or networking systems, equipment or components, not specified in 5A002.a.1.; 3. Computers, other items having information storage or processing as a primary function, and components therefor, not specified in 5A002.a.1. or 5A002.a.2.; N.B. For operating systems, see also 5D002.a.1. and 5D002.c.1. 4. Items, not specified in 5A002.a.1. to 5A002.a.3., where the 'cryptography for data confidentiality' having a 'described security algorithm' meets all of the following: a. It supports a non-primary function of the item; and b. It is performed by incorporated equipment or "software" that would, as a standalone item, be specified in Category 5, Part 2. Technical Notes: 1. For the purposes of 5A002.a., 'cryptography for data confidentiality' means "cryptography" that employs digital techniques for a cryptographic function or capability that is usable or can be made usable, other than any of the following: a. "Authentication"; b. Digital signature; c. Data integrity; d. Non-repudiation; e. Digital rights management, including the execution of copy-protected "software"; f. Encryption or decryption in support of entertainment, mass commercial broadcasts or medical records management; g. Wireless "personal area network" functionality implementing only published or commercial cryptographic standards; h. Cryptographic operations specially designed for and limited to banking use or money transactions, including the collection and settlement of fares or credit functions; i. Key management in support of and limited to functions and capabilities described in paragraph a. to h. above; or j. Cryptographic functions or capabilities that have not been activated or enabled, and can only be activated or enabled by means of secure "cryptographic activation". N.B. For 'cryptographic activation token' items, see 5A002.b., 5D002.b. and 5E002.b. 2. For the purposes of 5A002.a., 'described security algorithm' means any of the following: a. A 'symmetric algorithm' employing a key length in excess of 56 bits, not including parity bits; Technical Notes: For the purposes of 5A002.a. Technical Note 2.a.:1. 'Symmetric algorithm' is a cryptographic algorithm using an identical key for both encryption and decryption. 2. A common use of 'symmetric algorithms' is confidentiality of data. b. An "asymmetric algorithm" where the security of the algorithm is based on any of the following: 1. Factorisation of integers in excess of 512 bits (e.g., RSA); 2. Computation of discrete logarithms in a multiplicative group of a finite field of size greater than 512 bits (e.g., Diffie-Hellman over Z/pZ); or 3. Discrete logarithms in a group other than mentioned in paragraph b.2. in excess of 112 bits (e.g., Diffie-Hellman over an elliptic curve); or c. An "asymmetric algorithm" where the security of the algorithm is based on any of the following: 1. Shortest vector or closest vector problems associated with lattices (e.g., NewHope, Frodo, NTRUEncrypt, Kyber, Titanium); 2. Finding isogenies between Supersingular elliptic curves (e.g., Supersingular Isogeny Key Encapsulation); or 3. Decoding random codes (e.g., McEliece, Niederreiter). Technical Note: An algorithm described by Technical Note 2.c. may be referred to as being post-quantum, quantum-safe or quantum-resistant. Note 1: When necessary as determined by the appropriate authority in the exporter's country, details of items must be accessible and provided to the authority upon request, in order to establish any of the following: a. Whether the item meets the criteria of 5A002.a.1. to 5A002.a.4.; or b. Whether the 'cryptography for data confidentiality' having a 'described security algorithm' is usable without secure "cryptographic activation". Note 2: 5A002.a. does not control any of the following items, or specially designed "information security" components therefor: a. Smart cards and smart card 'readers/writers' as follows: 1. A smart card or an electronically readable personal document (e.g., token coin, e-passport) that meets any of the following: a. The 'cryptography for data confidentiality' having a 'described security algorithm' meets all of the following: 1. It is restricted for use in equipment or systems to which 5A002.a. does not control for reasons other than the Cryptography Note (Note 3 in Category 5 – Part 2); and 2. It cannot be reprogrammed for any other use; or: b. Having all of the following: 1. It is specially designed and limited to allow protection of 'personal data' stored within; 2. Has been, or can only be, personalised for public or commercial transactions or individual identification; and 3. Where the 'cryptography for data confidentiality' having a 'described security algorithm' is not user-accessible; Technical Note: For the purposes of 5A002.a. Note 2.a.1.b.1., 'personal data' includes any data specific to a particular person or entity, such as the amount of money stored and data necessary for "authentication". 2. 'Readers/writers'. Technical Note: For the purposes of 5A002.a. Note 2.a.2., 'readers/writers' include equipment that communicates with smart cards or electronically readable documents through a network. b. Not used; c. Portable or mobile radiotelephones designed for civil use , other than satellite telephones, that are not capable of any of the following: 1. Transmitting encrypted data directly to another radiotelephone or equipment (other than Radio Access Network (RAN) equipment); or 2. Passing encrypted data through RAN equipment (e.g., Radio Network Controller (RNC) or Base Station Controller (BSC)); d. Cordless telephone equipment not capable of end-to-end encryption where the maximum effective range of unboosted cordless operation (i.e. a single, unrelayed hop between terminal and home base station) is less than 400 metres according to the manufacturer's specifications; e. Portable or mobile radiotelephones and similar client wireless devices, designed for civil use, that have been customised for a specific civil industry application meeting all of the following: 1. The non-customised devices satisfy the provisions of the Cryptography Note (Note 3 in Category 5 – Part 2); and 2. The 'cryptography for data confidentiality' having a 'described security algorithm' of the non-customised devices is not affected by the customisation, and implements only published or commercial cryptographic standards; f. Not used; g. Mobile telecommunications Radio Access Network (RAN) equipment designed for civil use, which also meet the provisions of paragraphs a.2. to a.4. of the Cryptography Note (Note 3 in Category 5, Part 2), having an RF output power limited to 0,1W (20 dBm) or less, and supporting 32 or fewer concurrent users; h. Routers, switches, gateways or relays, where the 'cryptography for data confidentiality' having a 'described security algorithm' is limited to the tasks of "Operations, Administration or Maintenance" ("OAM") implementing only published or commercial cryptographic standards; i. General purpose computing equipment or servers, where the 'cryptography for data confidentiality' having a 'described security algorithm' meets all of the following: 1. Implements only published or commercial cryptographic standards; and 2. Is any of the following: a. Integral to a CPU that meets the provisions of Note 3 to Category 5, Part 2; b. Integral to an operating system to whitch 5D002 does not control; or c. Limited to "OAM" of the equipment ; or j. Items specially designed for a 'connected civil industry application', meeting all of the following: 1. Being any of the following: a. A network-capable endpoint device meeting any of the following: 1. The 'cryptography for data confidentiality' having a 'described security algorithm' is limited to securing 'non-arbitrary data' or the tasks of "Operations, Administration or Maintenance" ("OAM"); or 2. The device is limited to a specific 'connected civil industry application'; or b. Networking equipment meeting all of the following: 1. Being specially designed to communicate with the devices specified in paragraph j.1.a. above; and 2. The 'cryptography for data confidentiality' having a 'described security algorithm' is limited to supporting the 'connected civil industry application' of devices specified in paragraph j.1.a. above, or the tasks of "OAM" of this networking equipment or of other items specified in paragraph j. of this Note; and 2. Where the 'cryptography for data confidentiality' having a 'described security algorithm' implements only published or commercial cryptographic standards, and the cryptographic functionality cannot easily be changed by the user. Technical Notes: 1. For the purposes of 5A002.a. Note 2.j., 'connected civil industry application' means a network connected consumer or civil industry application other than "information security", digital communication, general purpose networking or computing. 2. For the purposes of 5A002.a. Note 2.j.1.a.1., 'non-arbitrary data' means sensor or metering data directly related to the stability, performance or physical measurement of a system (e.g., temperature, pressure, flow rate, mass, volume, voltage, physical location etc.), that cannot be changed by the user of the device. b. Being a 'cryptographic activation token'; Technical Note: For the purposes of 5A002.b., a 'cryptographic activation token' is an item designed or modified for any of the following: 1. Converting, by means of "cryptographic activation", an item not specified in Category 5, Part 2 into an item specified in 5A002.a. or 5D002.c.1., and not released by the Cryptography Note (Note 3 in Category 5, Part 2); or 2. Enabling, by means of "cryptographic activation", additional functionality specified in 5A002.a. of an item already specified in Category 5, Part 2. c. Designed or modified to use or perform "quantum cryptography"; Technical Note: For the purposes of 5A002.c., "quantum cryptography" is also known as Quantum Key Distribution (QKD). d. Designed or modified to use cryptographic techniques to generate channelising codes, scrambling codes or network identification codes, for systems using ultra-wideband modulation techniques and having any of the following: 1. A bandwidth exceeding 500 MHz; or 2. A "fractional bandwidth" of 20 % or more; e. Designed or modified to use cryptographic techniques to generate the spreading code for "spread spectrum" systems, other than those specified in 5A002.d., including the hopping code for "frequency hopping" systems. | |
| --- | --- | --- |
| 5A003 | Systems, equipment and components, for non-cryptographic "information security", as follows: a. Communications cable systems designed or modified to use mechanical, electrical or electronic means to detect surreptitious intrusion; Note: 5A003.a. only controls physical layer security. For the purpose of 5A003.a., the physical layer includes Layer 1 of the Reference Model of Open Systems Interconnection (OSI) (ISO/IEC 7498-1). b. Specially designed or modified to reduce the compromising emanations of information-bearing signals beyond what is necessary for health, safety or electromagnetic interference standards. | |
| --- | --- | --- |
| 5A004 | Systems, equipment and components for defeating, weakening or bypassing "information security", as follows: a. Designed or modified to perform 'cryptanalytic functions'. Note: 5A004.a. includes systems or equipment, designed or modified to perform 'cryptanalytic functions' by means of reverse engineering. Technical Note: For the purposes of 5A004.a., 'cryptanalytic functions' are functions designed to defeat cryptographic mechanisms in order to derive confidential variables or sensitive data, including clear text, passwords or cryptographic keys. b. Items, not specified in 4A005 or 5A004.a., designed to perform all of the following: 1. 'Extract raw data' from a computing or communications device; and 2. Circumvent "authentication" or authorisation controls of the device, in order to perform the function described in 5A004.b.1. Technical Note: For the purposes of 5A004.b.1., 'extract raw data' from a computing or communications device means to retrieve binary data from a storage medium (e.g., RAM, flash or hard disk) of the device without interpretation by the device’s operating system or filesystem. Note 1: 5A004.b. does not control systems or equipment specially designed for the "development" or "production" of a computing or communications device. Note 2: 5A004.b. does not include: a. Debuggers, hypervisors; b. Items limited to logical data extraction; c. Data extraction items using chip-off or JTAG; or d. Items specially designed and limited to jail-breaking or rooting. |
5B2 Test, Inspection and Production Equipment
| 5B002 | "Information security" test, inspection and "production" equipment, as follows: a. Equipment specially designed for the "development" or "production" of equipment specified in 5A002, 5A003, 5A004 or 5B002.b.; b. Measuring equipment specially designed to evaluate and validate the "information security" functions of the equipment specified in 5A002, 5A003 or 5A004, or of "software" specified in 5D002.a. or 5D002.c. |
5C2 Materials
None.
5D2 Software
| 5D002 | "Software" as follows: a. "Software" specially designed or modified for the "development", "production" or "use" of any of the following: 1. Equipment specified in 5A002 or "software" specified in 5D002.c.1.; 2. Equipment specified in 5A003 or "software" specified in 5D002.c.2.; or 3. Equipment or "software", as follows: a. Equipment specified in 5A004.a. or "software" specified in 5D002.c.3.a.; b. Equipment specified in 5A004.b. or "software" specified in 5D002.c.3.b. b. "Software" having the characteristics of a 'cryptographic activation token' specified in 5A002.b.; c. "Software" having the characteristics of, or performing or simulating the functions of, any of the following: 1. Equipment specified in 5A002.a., 5A002.c., 5A002.d. or 5A002.e.; Note: 5D002.c.1. does not control "software" limited to the tasks of "OAM" implementing only published or commercial cryptographic standards. 2. Equipment specified in 5A003; or 3. Equipment, as follows: a. Equipment specified in 5A004.a.; b. Equipment specified in 5A004.b. Note: 5D002.c.3.b. does not control "intrusion software". d. Not used. |
5E2 Technology
| 5E002 | "Technology" as follows: a. "Technology" according to the General Technology Note for the "development", "production" or "use" of equipment specified in 5A002, 5A003, 5A004 or 5B002, or of "software" specified in 5D002.a. or 5D002.c. Note: 5E002.a. does not control "technology" for items specified in 5A004.b., 5D002.a.3.b. or 5D002.c.3.b. b. "Technology" having the characteristics of a 'cryptographic activation token' specified in 5A002.b. Note: 5E002 includes "information security" technical data resulting from procedures carried out to evaluate or determine the implementation of functions, features or techniques specified in Category 5, Part 2. |
PART VIII
Category 6
CATEGORY 6 - SENSORS AND LASERS
6A Systems, Equipment and Components
Reading this document does not replace reading the official text published in the Official Journal of the European Union. We assume no responsibility for any inaccuracies arising from the conversion of the original to this format.
This text is published under EUR-Lex's own terms of reuse, not a Legalize or public-domain licence.
EUR-Lex
Creative Commons Attribution 4.0 International (CC BY 4.0)
© European Union, https://eur-lex.europa.eu — Source: EUR-Lex (Publications Office of the European Union). Reused under the Creative Commons Attribution 4.0 International (CC BY 4.0) licence. Only EU legislation published in the printed Official Journal of the European Union is deemed authentic; consolidated texts are reproduced here for documentation purposes and have been reformatted to Markdown.